SiYuan versions prior to 3.7.4 store attribute‑view field names without escaping and inject them directly into option elements using innerHTML. An attacker can craft a malicious field name that contains markup or script, which is then executed when a user opens the sort menu in the desktop client with Node integration enabled. This flaw is a classic stored cross‑site scripting vulnerability (CWE‑79) that, in this context, allows arbitrary JavaScript execution and therefore full control over the affected application and potentially the underlying operating system.

The affected product is SiYuan (siyuan‑note) before version 3.7.4. No specific sub‑versions were listed beyond the major cutoff. Users running any unreleased or unsupported custom builds that predate 3.7.4 are also at risk.

The CVSS score of 9.4 marks the vulnerability as critical. While no EPSS score is available, the lack of a KEV listing does not diminish its inherent risk. The attack requires the attacker to persuade or trick a user into opening the sort menu after the malicious field name has been stored. Node integration in the desktop client grants the injected script full access to the underlying system, turning this XSS into a potential remote code execution scenario. The exploitation path is user interactive but straightforward for an attacker who can influence field names in the database.